CVE-2009-0166
Published: 23 April 2009
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.
Notes
Author | Note |
---|---|
kees | this is also CVE-2009-0146, CVE-2009-0147, but not CVE-2009-0165. http://idisk.mac.com/drew_yao-Public/jbig2.zip |
mdeslaur | our cups uses the system pdftops, so we're not affected |
jdstrand | CUPS compiled with --disable-pdftops |
sbeattie | ipe uses system pdflatex |
ccdm94 | poppler 0.67.0 and forward uses xpdf 3.03+. |
Priority
Status
Package | Release | Status |
---|---|---|
cups Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
|
bionic |
Not vulnerable
|
|
cosmic |
Not vulnerable
|
|
dapper |
Does not exist
|
|
disco |
Not vulnerable
|
|
eoan |
Not vulnerable
|
|
focal |
Not vulnerable
|
|
groovy |
Not vulnerable
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Not vulnerable
|
|
impish |
Not vulnerable
|
|
intrepid |
Not vulnerable
|
|
jammy |
Not vulnerable
|
|
jaunty |
Not vulnerable
|
|
karmic |
Not vulnerable
|
|
kinetic |
Not vulnerable
|
|
lucid |
Not vulnerable
|
|
lunar |
Not vulnerable
|
|
maverick |
Not vulnerable
|
|
natty |
Not vulnerable
|
|
oneiric |
Not vulnerable
|
|
precise |
Not vulnerable
|
|
quantal |
Not vulnerable
|
|
raring |
Not vulnerable
|
|
saucy |
Not vulnerable
|
|
trusty |
Does not exist
(trusty was not-affected)
|
|
upstream |
Released
(1.3.10)
|
|
utopic |
Not vulnerable
|
|
vivid |
Not vulnerable
|
|
wily |
Not vulnerable
|
|
xenial |
Not vulnerable
|
|
yakkety |
Not vulnerable
|
|
zesty |
Not vulnerable
|
|
cupsys Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Not vulnerable
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Not vulnerable
|
|
hardy |
Not vulnerable
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(1.3.10)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
evince Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(linked to poppler)
|
bionic |
Not vulnerable
(linked to poppler)
|
|
cosmic |
Not vulnerable
(linked to poppler)
|
|
dapper |
Not vulnerable
(linked to poppler)
|
|
disco |
Not vulnerable
(linked to poppler)
|
|
eoan |
Not vulnerable
(linked to poppler)
|
|
focal |
Not vulnerable
(linked to poppler)
|
|
groovy |
Not vulnerable
(linked to poppler)
|
|
gutsy |
Not vulnerable
(linked to poppler)
|
|
hardy |
Not vulnerable
(linked to poppler)
|
|
hirsute |
Not vulnerable
(linked to poppler)
|
|
impish |
Not vulnerable
(linked to poppler)
|
|
intrepid |
Not vulnerable
(linked to poppler)
|
|
jammy |
Not vulnerable
(linked to poppler)
|
|
jaunty |
Not vulnerable
(linked to poppler)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
kinetic |
Not vulnerable
(linked to poppler)
|
|
lucid |
Not vulnerable
(linked to poppler)
|
|
lunar |
Not vulnerable
(linked to poppler)
|
|
maverick |
Not vulnerable
(linked to poppler)
|
|
natty |
Not vulnerable
(linked to poppler)
|
|
oneiric |
Not vulnerable
(linked to poppler)
|
|
precise |
Not vulnerable
(linked to poppler)
|
|
quantal |
Not vulnerable
(linked to poppler)
|
|
raring |
Not vulnerable
(linked to poppler)
|
|
saucy |
Not vulnerable
(linked to poppler)
|
|
trusty |
Does not exist
(trusty was not-affected [linked to poppler])
|
|
upstream |
Not vulnerable
(linked to poppler)
|
|
utopic |
Not vulnerable
(linked to poppler)
|
|
vivid |
Not vulnerable
(linked to poppler)
|
|
wily |
Not vulnerable
(linked to poppler)
|
|
xenial |
Not vulnerable
(linked to poppler)
|
|
yakkety |
Not vulnerable
(linked to poppler)
|
|
zesty |
Not vulnerable
(linked to poppler)
|
|
gpdf Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
ipe Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(uses system pdflatex)
|
bionic |
Not vulnerable
(uses system pdflatex)
|
|
cosmic |
Not vulnerable
(uses system pdflatex)
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Not vulnerable
(uses system pdflatex)
|
|
eoan |
Not vulnerable
(uses system pdflatex)
|
|
focal |
Not vulnerable
(uses system pdflatex)
|
|
groovy |
Not vulnerable
(uses system pdflatex)
|
|
gutsy |
Ignored
(end of life, was needs-triage)
|
|
hardy |
Not vulnerable
(uses system pdflatex)
|
|
hirsute |
Not vulnerable
(uses system pdflatex)
|
|
impish |
Not vulnerable
(uses system pdflatex)
|
|
intrepid |
Ignored
(end of life, was needs-triage)
|
|
jammy |
Not vulnerable
(uses system pdflatex)
|
|
jaunty |
Ignored
(end of life)
|
|
karmic |
Ignored
(end of life)
|
|
kinetic |
Not vulnerable
(uses system pdflatex)
|
|
lucid |
Not vulnerable
(uses system pdflatex)
|
|
lunar |
Not vulnerable
(uses system pdflatex)
|
|
maverick |
Not vulnerable
(uses system pdflatex)
|
|
natty |
Not vulnerable
(uses system pdflatex)
|
|
oneiric |
Not vulnerable
(uses system pdflatex)
|
|
precise |
Not vulnerable
(uses system pdflatex)
|
|
quantal |
Not vulnerable
(uses system pdflatex)
|
|
raring |
Not vulnerable
(uses system pdflatex)
|
|
saucy |
Not vulnerable
(uses system pdflatex)
|
|
trusty |
Does not exist
(trusty was not-affected [uses system pdflatex])
|
|
upstream |
Needs triage
|
|
utopic |
Not vulnerable
(uses system pdflatex)
|
|
vivid |
Not vulnerable
(uses system pdflatex)
|
|
wily |
Not vulnerable
(uses system pdflatex)
|
|
xenial |
Not vulnerable
(uses system pdflatex)
|
|
yakkety |
Not vulnerable
(uses system pdflatex)
|
|
zesty |
Not vulnerable
(uses system pdflatex)
|
|
kdegraphics Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Not vulnerable
(linked to poppler)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Not vulnerable
(linked to poppler)
|
|
hardy |
Not vulnerable
(linked to poppler)
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Not vulnerable
(linked to poppler)
|
|
jammy |
Does not exist
|
|
jaunty |
Not vulnerable
(linked to poppler)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
kinetic |
Does not exist
|
|
lucid |
Not vulnerable
(linked to poppler)
|
|
lunar |
Does not exist
|
|
maverick |
Not vulnerable
(linked to poppler)
|
|
natty |
Not vulnerable
(linked to poppler)
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
koffice Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Ignored
(end of life, was needs-triage)
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Ignored
(end of life, was needed)
|
|
jammy |
Does not exist
|
|
jaunty |
Released
(1:1.6.3-7ubuntu6.1)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
kinetic |
Does not exist
|
|
lucid |
Not vulnerable
(code not present)
|
|
lunar |
Does not exist
|
|
maverick |
Not vulnerable
(code not present)
|
|
natty |
Not vulnerable
(code not present)
|
|
oneiric |
Not vulnerable
(code not present)
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
libextractor Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
bionic |
Not vulnerable
(does not use xpdf anymore)
|
|
cosmic |
Ignored
(end of life)
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life)
|
|
focal |
Not vulnerable
(does not use xpdf anymore)
|
|
groovy |
Ignored
(end of life)
|
|
gutsy |
Ignored
(end of life, was needs-triage)
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Ignored
(end of life)
|
|
impish |
Ignored
(end of life)
|
|
intrepid |
Ignored
(end of life, was needs-triage)
|
|
jammy |
Not vulnerable
(does not use xpdf anymore)
|
|
jaunty |
Ignored
(end of life)
|
|
karmic |
Ignored
(end of life)
|
|
kinetic |
Not vulnerable
(does not use xpdf anymore)
|
|
lucid |
Ignored
(end of life)
|
|
lunar |
Not vulnerable
(does not use xpdf anymore)
|
|
maverick |
Ignored
(end of life)
|
|
natty |
Ignored
(end of life)
|
|
oneiric |
Ignored
(end of life)
|
|
precise |
Ignored
(end of life)
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
(end of life)
|
|
trusty |
Not vulnerable
(does not use xpdf anymore)
|
|
upstream |
Needs triage
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Not vulnerable
(does not use xpdf anymore)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Ignored
(end of life)
|
|
pdfkit.framework Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
pdftohtml Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
poppler Launchpad, Ubuntu, Debian |
artful |
Released
(0.10.5-1ubuntu2)
|
bionic |
Released
(0.10.5-1ubuntu2)
|
|
cosmic |
Released
(0.10.5-1ubuntu2)
|
|
dapper |
Released
(0.5.1-0ubuntu7.5)
|
|
disco |
Released
(0.10.5-1ubuntu2)
|
|
eoan |
Released
(0.10.5-1ubuntu2)
|
|
focal |
Released
(0.10.5-1ubuntu2)
|
|
groovy |
Released
(0.10.5-1ubuntu2)
|
|
gutsy |
Ignored
(end of life, was needs-triage)
|
|
hardy |
Released
(0.6.4-1ubuntu3.2)
|
|
hirsute |
Released
(0.10.5-1ubuntu2)
|
|
impish |
Released
(0.10.5-1ubuntu2)
|
|
intrepid |
Released
(0.8.7-1ubuntu0.2)
|
|
jammy |
Released
(0.10.5-1ubuntu2)
|
|
jaunty |
Released
(0.10.5-1ubuntu2)
|
|
karmic |
Released
(0.10.5-1ubuntu2)
|
|
kinetic |
Released
(0.10.5-1ubuntu2)
|
|
lucid |
Released
(0.10.5-1ubuntu2)
|
|
lunar |
Released
(0.10.5-1ubuntu2)
|
|
maverick |
Released
(0.10.5-1ubuntu2)
|
|
natty |
Released
(0.10.5-1ubuntu2)
|
|
oneiric |
Released
(0.10.5-1ubuntu2)
|
|
precise |
Released
(0.10.5-1ubuntu2)
|
|
quantal |
Released
(0.10.5-1ubuntu2)
|
|
raring |
Released
(0.10.5-1ubuntu2)
|
|
saucy |
Released
(0.10.5-1ubuntu2)
|
|
trusty |
Released
(0.10.5-1ubuntu2)
|
|
upstream |
Needs triage
|
|
utopic |
Released
(0.10.5-1ubuntu2)
|
|
vivid |
Released
(0.10.5-1ubuntu2)
|
|
wily |
Released
(0.10.5-1ubuntu2)
|
|
xenial |
Released
(0.10.5-1ubuntu2)
|
|
yakkety |
Released
(0.10.5-1ubuntu2)
|
|
zesty |
Released
(0.10.5-1ubuntu2)
|
|
tetex-bin Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Not vulnerable
(linked to poppler)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
texlive-bin Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(linked to poppler)
|
bionic |
Not vulnerable
(linked to poppler)
|
|
cosmic |
Not vulnerable
(linked to poppler)
|
|
dapper |
Does not exist
|
|
disco |
Not vulnerable
(linked to poppler)
|
|
eoan |
Not vulnerable
(linked to poppler)
|
|
focal |
Not vulnerable
(linked to poppler)
|
|
groovy |
Not vulnerable
(linked to poppler)
|
|
gutsy |
Not vulnerable
(linked to poppler)
|
|
hardy |
Not vulnerable
(linked to poppler)
|
|
hirsute |
Not vulnerable
(linked to poppler)
|
|
impish |
Not vulnerable
(linked to poppler)
|
|
intrepid |
Not vulnerable
(linked to poppler)
|
|
jammy |
Not vulnerable
(linked to poppler)
|
|
jaunty |
Not vulnerable
(linked to poppler)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
kinetic |
Not vulnerable
(linked to poppler)
|
|
lucid |
Not vulnerable
(linked to poppler)
|
|
lunar |
Not vulnerable
(linked to poppler)
|
|
maverick |
Not vulnerable
(linked to poppler)
|
|
natty |
Not vulnerable
(linked to poppler)
|
|
oneiric |
Not vulnerable
(linked to poppler)
|
|
precise |
Not vulnerable
(linked to poppler)
|
|
quantal |
Not vulnerable
(linked to poppler)
|
|
raring |
Not vulnerable
(linked to poppler)
|
|
saucy |
Not vulnerable
(linked to poppler)
|
|
trusty |
Does not exist
(trusty was not-affected [linked to poppler])
|
|
upstream |
Needs triage
|
|
utopic |
Not vulnerable
(linked to poppler)
|
|
vivid |
Not vulnerable
(linked to poppler)
|
|
wily |
Not vulnerable
(linked to poppler)
|
|
xenial |
Not vulnerable
(linked to poppler)
|
|
yakkety |
Not vulnerable
(linked to poppler)
|
|
zesty |
Not vulnerable
(linked to poppler)
|
|
xpdf Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(3.02-2)
|
bionic |
Not vulnerable
(3.02-2)
|
|
cosmic |
Not vulnerable
(3.02-2)
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Not vulnerable
(3.02-2)
|
|
eoan |
Not vulnerable
(3.02-2)
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
gutsy |
Ignored
(end of life, was needs-triage)
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Not vulnerable
(3.02-2)
|
|
impish |
Not vulnerable
(3.02-2)
|
|
intrepid |
Ignored
(end of life, was needs-triage)
|
|
jammy |
Not vulnerable
(3.02-2)
|
|
jaunty |
Released
(3.02-1.4ubuntu2.9.04.1)
|
|
karmic |
Released
(3.02-1.4ubuntu2.9.10.1)
|
|
kinetic |
Not vulnerable
(3.02-2)
|
|
lucid |
Not vulnerable
(3.02-2)
|
|
lunar |
Not vulnerable
(3.02-2)
|
|
maverick |
Not vulnerable
(3.02-2)
|
|
natty |
Not vulnerable
(3.02-2)
|
|
oneiric |
Not vulnerable
(3.02-2)
|
|
precise |
Not vulnerable
(3.02-2)
|
|
quantal |
Not vulnerable
(3.02-2)
|
|
raring |
Not vulnerable
(3.02-2)
|
|
saucy |
Not vulnerable
(3.02-2)
|
|
trusty |
Does not exist
(trusty was not-affected [3.02-2])
|
|
upstream |
Released
(3.02-2)
|
|
utopic |
Not vulnerable
(3.02-2)
|
|
vivid |
Not vulnerable
(3.02-2)
|
|
wily |
Not vulnerable
(3.02-2)
|
|
xenial |
Not vulnerable
(3.02-2)
|
|
yakkety |
Not vulnerable
(3.02-2)
|
|
zesty |
Not vulnerable
(3.02-2)
|